[Employee Name]
This phish typically originates from a non-Cornell email address. The sender may appear as "[Spoofed Name] <[user]@gmail.com>" and impersonates a member of university leadership. The message body and individual being impersonated may vary. Do not reply to the sender. The scammer's goal is typically to coerce the recipient into purchasing gift cards.
First Example
Do you have a moment? I have a request. I'm in a conference meeting right now and only have access to mail.
No calls, just reply to my email.
[Spoofed Name]
Executive Director
Second Example
Do you have a moment? I have a discreet request that I'd like you to assist me with. I'm currently in a meeting and can only communicate via email. Please respond to my email, as I won't be able to take calls at this time
[Spoofed Name]
President
Kind Regards
Sent From my Mail